Canadian authorities arrested Ottawa resident Jacob Butler, alleged online as “Dort,” and U.S. prosecutors unsealed charges accusing him of running the Kimwolf Internet-of-Things botnet that hijacked millions of connected devices. The complaint says Kimwolf infected devices such as cameras and digital photo frames, issued more than 25,000 attack commands, powered distributed denial-of-service attacks measured at nearly 30 terabits per second, and was also rented to other criminals; the case follows March seizures of Kimwolf infrastructure and related botnets Aisuru, JackSkid, and Mossad.
Why it matters: This matters to internet providers, enterprises, and anyone running exposed connected devices because it shows how insecure Internet-of-Things products can be turned into large-scale attack infrastructure. Defenders should keep internet-facing devices patched, disable unnecessary exposure, and review mitigations tied to the exploitation path Kimwolf used to spread.
2026.05.22
98% relevant
This is the same underlying event: the arrest of Ottawa resident Jacob Butler, alleged to be 'Dort,' over operating the KimWolf DDoS-for-hire botnet. The article adds specifics from the unsealed U.S. complaint, including the charge of aiding and abetting computer intrusion, the claim that KimWolf infected more than 1 million devices, issued over 25,000 attack commands, generated attacks approaching 30 Tbps, and was linked to attacks including one against Department of Defense IP space.
Eduard Kovacs
2026.05.22
99% relevant
This article is the same underlying event: the arrest of Ottawa resident Jacob Butler ('Dort') as the alleged Kimwolf botnet operator, with added detail from the Justice Department on the extradition request, the specific aiding-and-abetting computer intrusion charge, and seizure warrants targeting services supporting 45 DDoS-for-hire platforms linked to the botnet.
Sergiu Gatlan
2026.05.22
99% relevant
This article covers the same underlying event: the arrest and charging of Jacob Butler, allegedly known as "Dort," as the suspected KimWolf botnet administrator. It adds details from the unsealed U.S. complaint, the extradition posture, the specific aiding-and-abetting charge, losses to victims, and related seizures of 45 DDoS-for-hire platforms tied to the broader disruption effort.
BrianKrebs
2026.05.21
100% relevant
This article establishes a distinct story because it is the first item here centered on the arrest and cross-border criminal charges against the alleged operator of the Kimwolf IoT botnet.
← Back to all stories